-2

The server is based on Linux and applications are based on Android and iOS.

I was looking through "Linux Hardening Guide" as someone recommended it to me in order to harden Linux servers. I looked at the syllabus of the book, but that's not what I want.

I want to learn to protect web servers from various attacks. For example, how to prevent a web server from SQL injection attacks? How to protect servers from CSRF attacks? The "how to" part is given in reports, but it's not clearly understandable form. Also, sites like OWASP and Portswigger teach how to attack, but not how to prevent such attacks.

How do I learn this skill?

7
  • 3
    I have the feeling that you don't understand yet what you want to learn. Securing web applications against attacks like SQL injection and CSRF is unspecific to the OS and thus a very different topic from securing Linux servers, so asking for material about securing Linux servers by providing examples about attacks against web applications does not make much sense. So the first skill you probably need is to understand what these attacks are about in the first place. These topics are not simple so expect a steep learning path. A start regarding SQL injection might be bobby-tables.com Commented Oct 8, 2023 at 5:14
  • 2
    "so you mean this is dev's job and not admin's job?" - it's the job of both. It is the job of the admin to add additional protections against potential vulnerabilities in the applications they deploy, i.e. not rely on the application developers making everything perfect. It is the job of a developer to secure their application by design, i.e. not rely on the admins to add some kind of protection on top of the application. Protection added on top like a web application firewall, intrusion detection system, ... are only able protect against some attacks and also have false positives. Commented Oct 8, 2023 at 5:45
  • 2
    But even as an admin you need to understand what you want to protect. Is ist the web application against attacks against the user, against leakage of the data, against attacks the underlying OS where the application are running, against attacks against the system or network where the application is running, ... This is a very wide field and there is no tutorial to cover this all in an easy way. Commented Oct 8, 2023 at 5:49
  • 2
    Also, your goal should not be to protect servers against penetration testing attacks. Instead you should protect applications and servers against real attacks, which is very different from just trying to work around some findings of a penetration test. Commented Oct 8, 2023 at 5:52
  • 1
    "Also sites like owasp, portswigger teach how to attack, but not how to prevent such attacks." - I recommend to take a deeper look what these sites actually offer. Example owasp CSRF explains what the vulnerability is, how to prevent by design, how to detect in code review, how to test for such vulnerabilities ... Similar does portswigger CSRF Commented Oct 8, 2023 at 10:32

2 Answers 2

1

I am currently learning the opposite - how to attack. But I am also learning full stack web development to help me understand how these things are built so I can better learn how to attack them. I don't need to learn it to the point that I can get a job as a full stack web developer, but enough to understand how things are built.

In your case it would be helpful to learn how the attacks work. Just like in my case, not so you can necessarily carry them out, but so that you understand the principles of how they work. You can take that knowledge and apply it to the defence. You will likely not be able to anticipate every attack (that's why pentesters and red teams exist) but should give you an understanding behind the theory of the attacks.

You mentioned OWASP and Portswigger - their documentation talks about the vulnerabilities but also about how to prevent them.

1
  • You would need to learn both imho. PortSwigger also offers good certifications in the field and knowing OWASP Top 10 is essential. Commented Oct 8, 2023 at 13:36
0

You will hardly find a single book that covers all relevant attack scenarios in the necessary depth - the subject area is too diverse. Rather, different knowledge in different areas is necessary.

As a server operator, you cannot intercept all scenarios. An SQL injection is usually an application level problem, not a server configuration problem. There may be ways to detect it, but more purposeful would be to close this gap in the application.

A good start could be the following guide, so you can get an overview of the necessary todos: https://github.com/imthenachoman/How-To-Secure-A-Linux-Server

1
  • 1
    The link doesn't address what the OP asks.
    – schroeder
    Commented Oct 9, 2023 at 8:21

Not the answer you're looking for? Browse other questions tagged .